ID. Date of interview 
date 97/92/20 


ID. Time interview started 
start 44:21:08 


ID.end Completion date of interview 
Date 97/02/20 


ID.end Time interview ended 
14:44:51 


ID. Duration of interview 
time 93.72 


new Case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 
O Yes 
© No 


©) Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


More clarity required on the following points: 1. Clock start date in scenarios where clarification from the 
data subject is needed. It used to be a lot easier and more time/money-efficient when we could wait for 
the data subject to confirm what they require from the SAR. It is now unclear how we are meant to 
progress with a SAR within the same deadlines if we do not receive more information from the data 
subject in time. 2. Definition of 'extensive efforts' 3. You claim that when a request is excessive or 
manifestly unfounded, we can either charge a fee or refuse the request. Because we have the option to 
refuse the request, the option to ‘charge a fee' becomes redundant. As the fee can only be charged for 
administrative purposes such as postage and printing, it would not cover the labour fees and therefore 
the efforts to comply with such request. So, logically most companies would choose to simply refuse the 
request. Would that be a reasonable approach to take? If not, please provide clarity in how we should 
make this decision (charging a fee vs refusing the request). 4. Expectations on back up vs live data - in 
most scenarios 'back up' data would be same as ‘live data’. Can you please provide clarity where we still 
need to search in both environments. 5. Can we extend the time for response if we're seeking consent 
from a third party to release their data as part of a SAR, where the third party can be identified? 6. You 
claim that we should justify and document reasons when relying on an exemption, or when we withhold 
information when it's related to a third-party. Do we need to record every single document/piece of 
personal data we used an exemption for, because sometimes it may be hundreds of documents/data that 
are exempt, and individual documentation for each case of exemption will just generate more data. 
Please clarify whether it is sufficient to document an exemption for a collection or a category of data/third- 
party information. 7. You say that we 'should not assume that a reference is confidential’ and we 'must 
be able to justify why this is the case.’ Please can you clarify how can this be done if, for instance, we 
don't fully understand/know the relationship between the employee/employer. 8. Some of the parts at 
the end on Health, Education, Social Work data seem quite similar and some parts don't seem to differ of 
how we treat any other data (e.g. "There are no special rules which allow you to charge fees if you are 
complying with a SAR for social work data’ - why is this necessary). Would you be able to provide this 
information in a more concise manner and perhaps outline the differences of how we treat this type of 
data. 


Q3 


Does the draft guidance contain enough examples? 
C) Yes 

©) No 

© Unsure / don't know 


If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


1. When making a decision whether to disclose third party information, related to the part "Circumstances 


relating to the individual making the request". 2. Guidance on technical issues - what can you rely on in 
complex cases? 


Q4 We have found that data protection professionals often struggle with applying and defining ‘manifestly 
unfounded or excessive’ subject access requests. We would like to include a wide range of examples 


from a variety of sectors to help you. Please provide some examples of manifestly unfounded and 
excessive 


requests below (if applicable). 


A solicitor submitted a request on behalf of their client (with a valid authority). A few months later, 
the data subject submitted a request for the same data again. We agreed to provide the data again 


upon receipt of a payment, but data subject refused claiming that they haven't received any data 
from the solicitor. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-Slightly Moderately 4-—Very 5-Extremely 
useful useful useful useful useful 


O O O © O 


Q6 


Q7 


Why have you given this score? 


To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


i rs P i) 
( ) \ ) \ j |! ) 
‘ea Ne W Naa 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


Are you answering as: 

( D An individual acting in a private capacity (eg someone providing their views as a member of the public) 
C) An individual acting in a professional capacity 

© On behalf of an organisation 

() Other 

Please specify the name of your organisation: 

Network Homes 


What sector are you from: 
Housing 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(|) ICO Facebook account 
©) ICO LinkedIn account 
© ICO website 
©) ICO newsletter 
C) ICO staff member 
C) Colleague 
©) Personal/work Twitter account 
(`) Personal/work Facebook account 
() Personal/work LinkedIn account 
O Other 
If other please specify: 


